Browser Isolation via Secure Tunnels for Cloud Apps
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional enterprise network security models are inadequate for modern cloud-based environments, where mobile users access applications from unsecured devices, increasing the risk of data exposure and cyber threats, as the perimeter is no longer confined to a single location.
Innovation Solution
The implementation of a cloud-based system that provides browser isolation by creating secure tunnels between user devices and applications, allowing only image content to be rendered locally while processing sensitive data in a secure, isolated cloud environment, thereby preventing data exfiltration and reducing attack risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional VPN and perimeter security models are used, then access control is maintained, but security effectiveness deteriorates due to unsecured mobile devices and extended network perimeter
Solution Approach 1:
The system segments the application delivery path by separating browser execution into two modes: isolated mode where the browser runs in a secure container on the network side, and direct mode where the browser runs on the user device. This segmentation allows the system to maintain security for sensitive applications while allowing flexibility for trusted applications, resolving the contradiction between security effectiveness and access flexibility.
Solution Approach 2:
The patent introduces a secure browser container as an intermediary between the user device and the application. This intermediary provides a controlled environment where applications can be executed securely, acting as a mediator that maintains security posture while enabling flexible access. The intermediary handles the trust boundary and allows selective execution of applications based on security policies.
2Object-affected harmful factors
If browser isolation is implemented, then security against malicious code is improved, but device complexity increases
Solution Approach 1:
The patent extracts the browser execution environment from the user device and places it on the network side in a secure container. By taking out the browser from the unsecured device environment, the system eliminates the risk of malicious code execution on user devices while maintaining the functionality. This extraction resolves the contradiction by providing malware protection without requiring complex security mechanisms on the device side.
Solution Approach 2:
The system employs disposable secure containers that are created, used, and discarded for each application session. These temporary containers provide the necessary isolation and security without requiring persistent complex security infrastructure. The disposable nature of these containers simplifies the overall system architecture while maintaining strong security guarantees.
3Loss of information
If applications are made invisible to unauthorized users, then data protection is improved, but access control complexity increases
Solution Approach 1:
Instead of the traditional approach where the server lists available applications and the client requests access, the patent inverts the approach by having the network side actively present only the authorized applications to users. Unauthorized applications remain completely invisible, and access is granted only through the secure container based on predefined policies. This inversion simplifies access control by eliminating the need for complex authentication mechanisms while achieving strong data protection.
Data Source
AI summary
Systems and methods include, responsive to a request to access an application, wherein the application is in one of a public cloud, a private cloud, and an enterprise network, and wherein the user device is remote over the Internet, determining if a user of the user device is permitted to access the application and whether the application should be provided in an isolated browser; responsive to the determining, creating secure tunnels between the user device, an isolation service operating the isolated browser, and the application based on connection information; loading the application in the isolated browser, via the secure tunnels; and providing image content for the application to the user device, via the secure tunnels.